当前位置： 首页 > news >正文

ASP.NET Core 中JWT的基本使用

news 2025/5/29 10:00:17

文章目录

  • 前言
  • 一、JWT与RBAC
  • 二、JWT 的作用
  • 三、RBAC 的核心思想
  • 四、使用
    • 1、配置文件 (appsettings.json)
    • 2、JWT配置模型 (Entity/JwtSettings.cs)
    • 3、服务扩展类，JWT配置 (Extensions/ServiceExtensions.cs)
    • 4、用户仓库接口服务
    • 5、认证服务 (Interface/IAuthService.cs、Repository/AuthService.cs)
    • 6、控制器（验证登录权限，生成Token）
    • 7、注册服务
    • 8、使用示例
    • 9、高级权限控制
      • 1）实现自定义策略处理器：
      • 2）注册服务及定义策略
      • 3）使用自定义策略
  • 五、关键安全配置
  • 六、完整流程说明
  • 总结

前言

在ASP.NET Core Web API中实现基于JWT的RBAC（基于角色的访问控制）。

一、JWT与RBAC

JWT（JSON Web Token）与 RBAC（基于角色的访问控制，Role-Based Access Access Control）结合使用时，是一种通过令牌（Token）传递用户角色信息，并基于角色实现权限管理的安全机制。

二、JWT 的作用

  • JWT 是一种紧凑的、自包含的令牌格式，通常用于身份验证和授权。其结构分为三部分：
    • Header：算法和令牌类型（如 HS256 或 RSA）。
    • Payload：存放用户信息（如用户ID、角色）和声明（如过期时间）。
    • Signature：对前两部分的签名，确保令牌未被篡改。

三、RBAC 的核心思想

  • RBAC 通过角色管理权限，而非直接赋予用户权限：
    • 角色（Role）：定义一组权限（如 admin、user）。
    • 权限（Permission）：资源或操作（如 read:data、delete:user）。
    • 用户被分配角色，间接获得权限。

四、使用

1、配置文件 (appsettings.json)

  1. appsettings.json
    {"JwtSettings": {"Issuer": "yourdomain.com","Audience": "yourapp","SecretKey": "YourSuperSecretKeyAtLeast32CharactersLong","ExpirationMinutes": 60,"RefreshTokenExpirationDays": 7}"AllowedHosts": "*"
}

2、JWT配置模型 (Entity/JwtSettings.cs)

  1. JwtSettings.cs
    namespace JWTWebAPI.Entity
{public class JwtSettings{public string Issuer { get; set; } = string.Empty;public string Audience { get; set; } = string.Empty;public string SecretKey { get; set; } = string.Empty;public int ExpirationMinutes { get; set; }public int RefreshTokenExpirationDays { get; set; }}
}

3、服务扩展类，JWT配置 (Extensions/ServiceExtensions.cs)

  1. ServiceExtensions.cs
    using JWTWebAPI.Entity;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Security.Claims;
using System.Text;namespace JWTWebAPI.Extensions
{public static class ServiceExtensions{// JWT认证配置public static void ConfigureJwtAuthentication(this IServiceCollection services, IConfiguration configuration){var jwtSettings = configuration.GetSection("JwtSettings").Get<JwtSettings>();services.AddAuthentication(options =>{options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;}).AddJwtBearer(options =>{options.TokenValidationParameters = new TokenValidationParameters{ValidateIssuer = false,ValidIssuer = jwtSettings.Issuer,ValidateAudience = false,ValidAudience = jwtSettings.Audience,ValidateLifetime = false,ValidateIssuerSigningKey = false,IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings.SecretKey!)), //ClockSkew = TimeSpan.Zero,RoleClaimType=ClaimTypes.Role};options.Events = new JwtBearerEvents{OnAuthenticationFailed = context =>{if (context.Exception.GetType() == typeof(SecurityTokenExpiredException)){context.Response.Headers.Append("Token-Expired", "true");}return Task.CompletedTask;}};});}// 授权策略配置public static void ConfigureAuthorizationPolicies(this IServiceCollection services){services.AddAuthorization(options =>{// 基于角色的策略options.AddPolicy("AdminOnly", policy =>policy.RequireRole("admin"));options.AddPolicy("ManagerOnly", policy =>policy.RequireRole("admin"));// 基于自定义权限的策略options.AddPolicy("ContentEditor", policy =>policy.RequireClaim("permission", "content.edit"));options.AddPolicy("UserManagement", policy =>policy.RequireClaim("permission", "user.manage"));});}} 
}

4、用户仓库接口服务

  1. Interfaces/IUserRepository.cs

    using JWTWebAPI.Entity;namespace JWTWebAPI.Interface
{public interface IUserRepository{Task<AspNetUsers?> GetUserByCredentials(string username, string password);Task SaveRefreshToken(long userId, string refreshToken, DateTime expiry);Task<AspNetUsers?> GetUserByRefreshToken(string refreshToken);}
}

  2. Repositories/UserRepository.cs

    using JWTWebAPI.Data;
using JWTWebAPI.Entity;
using JWTWebAPI.Interface;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Org.BouncyCastle.Crypto.Generators;namespace JWTWebAPI.Repository
{public class UserRepositor : IUserRepository{private readonly MyDbContext _context;private readonly UserManager<AspNetUsers> _userManager;public UserRepositor(MyDbContext context, UserManager<AspNetUsers> userManager, RoleManager<Role> roleManager){_context = context;_userManager = userManager;}public async Task<AspNetUsers?> GetUserByCredentials(string username, string password){try{var user=await _userManager.FindByNameAsync(username);if (user == null) return null;return user;}catch (Exception){throw;}}public async Task<AspNetUsers?> GetUserByRefreshToken(string refreshToken){return await _context.Users.FirstOrDefaultAsync(u =>u.RefreshToken == refreshToken &&u.RefreshTokenExpiry > DateTime.UtcNow);}public async Task SaveRefreshToken(long userId, string refreshToken, DateTime expiry){var user = await _context.Users.FindAsync(userId);if (user != null){user.RefreshToken = refreshToken;user.RefreshTokenExpiry = expiry;await _context.SaveChangesAsync();}}}
}

5、认证服务 (Interface/IAuthService.cs、Repository/AuthService.cs)

  1. IAuthService.cs

    using JWTWebAPI.Entity;namespace JWTWebAPI.Interface
{public interface IAuthService{Task<AuthResult> Authenticate(string username, string password);Task<AuthResult> RefreshToken(string token, string refreshToken);}
}

  2. AuthService.cs

    using JWTWebAPI.Entity;
using JWTWebAPI.Interface;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Text;namespace JWTWebAPI.Repository
{public class AuthService : IAuthService{private readonly JwtSettings _jwtSettings;private readonly IUserRepository _userRepository;public AuthService(IOptions<JwtSettings> jwtSettings, IUserRepository userRepository){_jwtSettings = jwtSettings.Value;_userRepository = userRepository;}public async Task<AuthResult> Authenticate(string username, string password){var user = await _userRepository.GetUserByCredentials(username, password);if (user == null) return null;var claims = new[]{new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),new Claim(ClaimTypes.Name, user.UserName),new Claim(ClaimTypes.Role, user.Role) // 用户角色	                };var token = GenerateJwtToken(claims);var refreshToken = GenerateRefreshToken();await _userRepository.SaveRefreshToken(user.Id, refreshToken,DateTime.UtcNow.AddDays(_jwtSettings.RefreshTokenExpirationDays));return new AuthResult{Token = token,RefreshToken = refreshToken,ExpiresIn = _jwtSettings.ExpirationMinutes * 60};}public Task<AuthResult> RefreshToken(string token, string refreshToken){throw new NotImplementedException();}private string GenerateJwtToken(IEnumerable<Claim> claims){var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtSettings.SecretKey));var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);var token = new JwtSecurityToken(issuer: _jwtSettings.Issuer,audience: _jwtSettings.Audience,claims: claims,expires: DateTime.UtcNow.AddMinutes(_jwtSettings.ExpirationMinutes),signingCredentials: creds);return new JwtSecurityTokenHandler().WriteToken(token);}private static string GenerateRefreshToken(){var randomNumber = new byte[32];using var rng = RandomNumberGenerator.Create();rng.GetBytes(randomNumber);return Convert.ToBase64String(randomNumber);}}
}

  3. AuthResult.cs

    namespace JWTWebAPI.Entity
{public class AuthResult{public string Token { get; set; }public string RefreshToken { get; set; }public int ExpiresIn { get; set; }}
}

6、控制器（验证登录权限，生成Token）

  1. AuthController.cs
    using JWTWebAPI.Entity;
using JWTWebAPI.Interface;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Identity.Data;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Runtime;
using System.Security.Claims;
using System.Text;namespace JWTWebAPI.Controllers
{[Route("api/[controller]/[action]")][ApiController]public class AuthController : ControllerBase{private readonly IConfiguration _config;private readonly IOptionsSnapshot<JwtSettings> _settings;private readonly IAuthService _authService;public AuthController(IConfiguration config, IOptionsSnapshot<JwtSettings> settings, IAuthService authService){_config = config;_settings = settings;_authService = authService;}[HttpPost][AllowAnonymous]public async Task<IActionResult> Login([FromBody] LoginModel request){var result = await _authService.Authenticate(request.Username, request.Password);if (result == null) return Unauthorized();return Ok(result);}[HttpPost][AllowAnonymous]public async Task<IActionResult> Refresh([FromBody] RefreshTokenRequest request){var result = await _authService.RefreshToken(request.Token, request.RefreshToken);if (result == null) return Unauthorized();return Ok(result);}}
}
  2. LoginModel.cs
    namespace JWTWebAPI.Entity
{public class LoginModel{public string Username { get; set; } = string.Empty;public string Password { get; set; } = string.Empty;}
}
  3. RefreshTokenRequest.cs
    public class RefreshTokenRequest
{[Required] public string Token { get; set; }[Required] public string RefreshToken { get; set; }
}

7、注册服务

  1. Program.cs

    using JWTWebAPI.Data;
using JWTWebAPI.Entity;
using JWTWebAPI.Extensions;
using JWTWebAPI.Interface;
using JWTWebAPI.Repository;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;var builder = WebApplication.CreateBuilder(args);
// 添加数据库上下文
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
builder.Services.AddDbContext<MyDbContext>(opt => {opt.UseSqlServer(connectionString);
});
builder.Services.AddDataProtection();
builder.Services.AddIdentityCore<AspNetUsers>(opt => {
opt.Lockout.MaxFailedAccessAttempts = 5;//登录失败多少次账号被锁定
opt.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(1);//锁定多长时间
opt.Password.RequireDigit = false;//密码是否需要数字    
opt.Password.RequireLowercase = false;//密码是否需要小写字符
opt.Password.RequireUppercase = false;//密码是否需要大写字符
opt.Password.RequireNonAlphanumeric = false;//密码是否需要非字母数字的字符
opt.Password.RequiredLength = 6;//密码长度opt.Tokens.PasswordResetTokenProvider = TokenOptions.DefaultEmailProvider;//密码重置令牌，使用默认的邮箱令牌提供程序来生成和验证令牌。此提供程序通常与用户邮箱关联，生成的令牌会通过邮件发送给用户,保证用户通过邮件接收密码重置链接。
opt.Tokens.EmailConfirmationTokenProvider = TokenOptions.DefaultEmailProvider;//配置邮箱确认令牌（Email Confirmation Token）的生成和验证所使用的提供程序（Provider）
});
var idBuilder = new IdentityBuilder(typeof(AspNetUsers), typeof(Role), builder.Services);idBuilder.AddEntityFrameworkStores<MyDbContext>()
.AddDefaultTokenProviders().AddUserManager<UserManager<AspNetUsers>>()
.AddRoleManager<RoleManager<Role>>();builder.Services.Configure<JwtSettings>(builder.Configuration.GetSection("JwtSettings"));
// 添加JWT认证
// 3. 认证服务配置（来自ServiceExtensions）
builder.Services.ConfigureJwtAuthentication(builder.Configuration);  // 扩展方法ServiceExtensions.cs
// 4. 授权策略配置（来自ServiceExtensions）
builder.Services.ConfigureAuthorizationPolicies();  // 扩展方法ServiceExtensions.cs// 5. 注册应用服务
builder.Services.AddScoped<IUserRepository, UserRepositor>();
builder.Services.AddScoped<IAuthService, AuthService>();builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
//跨域
builder.Services.AddCors(options =>
{options.AddPolicy("AllowAll", builder =>builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
});var app = builder.Build();// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{app.UseSwagger();app.UseSwaggerUI();
}app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.UseCors("AllowAll");
app.MapControllers();app.Run();

8、使用示例

  1. AdminController.cs
    在需要权限的Controller上添加特性：
    using JWTWebAPI.Entity;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;namespace JWTWebAPI.Controllers
{[Route("api/[controller]/[action]")][ApiController]public class AdminController : ControllerBase{[HttpGet][Authorize(Roles = "admin")] // 仅Admin角色可访问public IActionResult GetAdminData(){return Ok("Admin data");}[HttpGet][Authorize(Policy = "AdminOnly")] // 使用策略public IActionResult GetUserInfo(){return Ok("User info");}}
}

9、高级权限控制

1）实现自定义策略处理器：

  1. PermissionHandler.cs

    using JWTWebAPI.Entity;
using Microsoft.AspNetCore.Authorization;namespace JWTWebAPI.Extensions
{public class PermissionHandler : AuthorizationHandler<PermissionRequirement>{protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement){var permissions = context.User.FindFirst(c => c.Type == "permissions")?.Value.Split(',');if (permissions?.Any(p => p == requirement.Permission) == true){context.Succeed(requirement);}return Task.CompletedTask;}}
}

  2. PermissionRequirement.cs

    using Microsoft.AspNetCore.Authorization;namespace JWTWebAPI.Entity
{public class PermissionRequirement: IAuthorizationRequirement{public string Permission { get; set; }public PermissionRequirement(string permission){Permission = permission;}}
}

2）注册服务及定义策略

  1. Program.cs
    //注册
builder.Services.AddSingleton<IAuthorizationHandler, PermissionHandler>();
//定义策略（可放在扩展方法中：ServiceExtensions.cs中的ConfigureAuthorizationPolicies方法中）
builder.Services.AddAuthorization(options =>
{options.AddPolicy("UpdateValidate", policy =>policy.Requirements.Add(new PermissionRequirement("profile.update")));
});

3）使用自定义策略

  1. AdminController.cs
    using JWTWebAPI.Entity;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;namespace JWTWebAPI.Controllers
{[Route("api/[controller]/[action]")][ApiController]public class AdminController : ControllerBase{[HttpGet][Authorize(Policy = "UpdateValidate")]public IActionResult GetMessage(){return Ok("自定义验证");}}
}

五、关键安全配置

  • 密钥安全：
    • 生产环境不要将密钥放在appsettings.json中
    • 使用Azure Key Vault或环境变量存储密钥
    builder.Configuration.AddEnvironmentVariables();
  • HTTPS重定向：
    app.UseHttpsRedirection();
  • CORS配置：
    services.AddCors(options =>
{options.AddPolicy("ApiPolicy", builder =>{builder.WithOrigins("https://your-frontend.com").AllowAnyHeader().AllowAnyMethod().AllowCredentials();});
});

六、完整流程说明

  1. 用户通过/api/auth/login获取JWT Token
  2. 后续请求在Header中添加Authorization: Bearer {token}
  3. 系统自动验证Token有效性
  4. 根据Controller/Action上的授权策略进行权限验证

总结

通过以上实现，可以构建灵活、可扩展的权限控制系统，满足以下场景：

  • 基于资源的细粒度控制
  • 动态权限管理
  • 多条件组合授权
http://www.xdnf.cn/news/672949.html

相关文章：

  • 分布式架构：解读不同数据一致性模型
  • ⚡ Hyperlane —— 比 Rocket 更快的 Rust Web 框架！
  • 3D草图绘制管道
  • 26考研 | 王道 | 第五章 传输层
  • AI in Game，大模型能力与实时音视频技术融合，交出AI应用新答卷
  • EMQX启用单向认证的SSl/TLS连接的配置步骤
  • 如何在加密数据上实现模糊查询？技术方案全解析
  • 视觉语言多模态模型的优化
  • 调试（gdb/cgdb）
  • Python+AI Agent：解锁MCP Servers的智能潜力
  • Python学习(2) ----- Python的类型
  • 《软件工程》实战— 在线教育平台开发
  • Matlab中gcb、gcbh、gcs的区别
  • 下一代 SaaS 平台的 AI 架构重构路径——多租户 AI 服务调度 · 多角色智能辅助 · 嵌入式 AIGC 能力的融合设计
  • 学习黑客 Metasploit 主要组件之 Exploit
  • 实时同步缓存，与阶段性同步缓存——补充理解《补充》
  • 塔能科技：有哪些国内工业节能标杆案例？
  • L1-112 现代战争 - java
  • 将 ubutun 的网络模式 从NAT 改到 桥接模式后，无法上网，linux 没有IP地址 的解决方案
  • Java设计模式之代理模式详解
  • 威联通QNAP替换docker源
  • 被忽视的 App 安全入口：资源文件暴露问题与 iOS 混淆实战（含 Ipa Guard 应用经验）
  • React从基础入门到高级实战：React 核心技术 - 错误处理与错误边界：构建稳定的应用
  • Springboot引入Spring Cloud for AWS的配置中心（Parameter Store和Secrets）
  • RK3568DAYU开发板-平台驱动开发：ADC驱动
  • 火柴INIBOX专业矿机登场，碾压现有Initverse挖矿设备
  • Java构建Tree并实现节点名称模糊查询
  • C 语言学习笔记（结构体1）
  • STM32的DMA入门指南：让单片机学会“自动搬运“数据
  • 【Day38】